372778f7e80dc027cffbe7fe2d79882cfd670c37d8f446a41abd1e14e5b4fefa

General

Target
30092026_0557_16032026_23반(일요일 10시)_외국어로서의한국어교육실습 학사일정 및 평가기준.lnk.zip
Size 343KB
Sample260930-gnk29ssdkc
SHA256 372778f7e80dc027cffbe7fe2d79882cfd670c37d8f446a41abd1e14e5b4fefa
MD5 86f89f5623e2e85db4e46d95a83a65d5
SHA1 e36aab80540f8358b022d0b7972229e9a0438ba9
SHA512 57d7ac04cc05bab817c81ad94e5f72e12a464470952c4771eb73872c9da75e17d7acc5602a51a7998726d88cb842cc99919738fe37d01a10190c87f10b40ec4e
SSDEEP 768:Iu6DCCCCCCYCCCCCCwCCCCCCzCCCCCChCCCCCCCTCCCCCCTCCCCCCKCCCCCCCeCQ:4Se
TLSH
T12F747C9A1000B2D3AC985EEF7697051FC8E1C2F90F2A7D666F7D11B42A8AF7D9C08553
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper
http://posco.or.kr/cheditor/attach/board_file/boardquery.php

Extracted

Language

ps1

Source

URLs

exe.dropper
http://posco.or.kr/cheditor/attach/board_file/boardquery.php

Targets

- Target
  23반(일요일 10시)_외국어로서의한국어교육실습 학사일정 및 평가기준.lnk
- Size 40.9MB
- SHA256 0ab4dec5e7ea4ecd1cce9236aba507c5e351b4648f0aa69e23024483298db38e
- MD5 12f9f84a5a307c7a599c7feb88c1dad1
- SHA1 60cba5158b7582f38be66be817f1f106a6a1ae9d
- SHA512 4a6bffd4a9d78621fa3bf34a157038fd09c7e98a5fce402c2c6a8a0a88af0b88caf554943b6f0203d112762338e49672a23d02e757fd9941736fb024c3992f92
- SSDEEP 96:8AwJqS08eAKeWVDxyXZ2fK/ITqCN3fp+mji/rd/M:8+S08edegDxyXZ2fKQTqCdfp+mcBM
- TLSH
  T1E8975624C6083DADFDE6F3B6A64AC1F5D4ED5C0E298869876373825D218338790ED5CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  23반(일요일 10시)_외국어로서의한국어교육실습 학습자 매뉴얼.lnk
- Size 40.5MB
- SHA256 77ce096c1a302e425132b9f4f5a23284e12c2b853d1ddbc0e96d9fc2165322be
- MD5 7a9b4e97a3cb9f1bd278bec03e45ba6e
- SHA1 ad9505d38f79c1271be7807b7862d4a83578a343
- SHA512 075e50bec68d4815fd0c1a42163be56bbac28ef5cdfea2646aaf8f5f15a5b1176aa35613d26fb0b81f5e30882080e402de11cc1c7d01cb9540a5bb1a094acca3
- SSDEEP 96:8FFCeJOeV66cDiE68y3R25yOjqQRG/rFka46MF:8vrJ5V66ch68yB25yOj3RG/rFv46m
- TLSH
  T19E9701AF7AF702A6CDBECD6A646E0E7194639D4D5768560040D3831720F1FE7AB83538
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4